RustBelt: Securing theFoundations of the RustProgramming Language

Ralf Jung, Jacques-Henri Jourdan, Robbert Krebbers,Derek DreyerPOPL 2018 in Los Angeles, USAMax Planck Institute for Software Systems (MPI-SWS), TU Delft

1

Rust – Mozilla’s replacement for C/C++

A safe & modern systems PL

• First-class functions• Polymorphism/generics• Traits ≈ Type classes incl.associated types• Control over resource management(e.g., memory allocation and data layout)• Strong type system guarantees:

• Type & memory safety; absence of data races

Goal of RustBelt project:Prove safety of Rust and its

standard library.

2

Rust – Mozilla’s replacement for C/C++

A safe & modern systems PL• First-class functions• Polymorphism/generics• Traits ≈ Type classes incl.associated types

• Control over resource management(e.g., memory allocation and data layout)• Strong type system guarantees:

• Type & memory safety; absence of data races

Goal of RustBelt project:Prove safety of Rust and its

standard library.

2

Rust – Mozilla’s replacement for C/C++

A safe & modern systems PL• First-class functions• Polymorphism/generics• Traits ≈ Type classes incl.associated types• Control over resource management(e.g., memory allocation and data layout)

• Strong type system guarantees:• Type & memory safety; absence of data races

Goal of RustBelt project:Prove safety of Rust and its

standard library.

2

Rust – Mozilla’s replacement for C/C++

A safe & modern systems PL• First-class functions• Polymorphism/generics• Traits ≈ Type classes incl.associated types• Control over resource management(e.g., memory allocation and data layout)• Strong type system guarantees:

• Type & memory safety; absence of data races

Goal of RustBelt project:Prove safety of Rust and its

standard library.

2

Rust – Mozilla’s replacement for C/C++

A safe & modern systems PL• First-class functions• Polymorphism/generics• Traits ≈ Type classes incl.associated types• Control over resource management(e.g., memory allocation and data layout)• Strong type system guarantees:

• Type & memory safety; absence of data races

Goal of RustBelt project:Prove safety of Rust and its

standard library.

2

Contributions

• λRust: Core calculus representing a fragmentof Rust and its type system• Semantic soundness proof using logicalrelation in Iris• Safety proof of some important unsafelibraries

3

Rust 101

4

Rust 101

Aliasing+

Mutation

4

Ownership

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

v.push(4);

5

Ownership

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

v.push(4);

// Send v to another thread

send(v);

Ownership transferred to send:

fn send(Vec<i32>)

5

Ownership

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

v.push(4);

// Send v to another thread

send(v);

// Let's try to use v again

v.push(5);

Potentially racing access!

Error: v has been moved.Prevents possible data race.

5

Ownership

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

v.push(4);

// Send v to another thread

send(v);

x: T expresses ownership of x at type T

• Mutation allowed, no aliasing• We can deallocate x

Why is v not moved?

5

Ownership

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

v.push(4);

// Send v to another thread

send(v);

x: T expresses ownership of x at type T

• Mutation allowed, no aliasing• We can deallocate x

Why is v not moved?

5

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanentlyType of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanently

Type of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanentlyType of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanently

Type of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanently

Type of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Borrowing and lifetimes

// Allocate v on the heap

let mut v : Vec<i32> = vec![1, 2, 3];

Vec::push(&mut v, 4);

// Send v to another thread

send(v);

Method call was just sugar.&mut v creates a reference.

Pass-by-reference: Vec::push borrows ownership temporarily

Pass-by-value: Ownership moved to send permanentlyType of push:fn Vec::push<'a>(&'a mut Vec<i32>, i32)

Lifetime 'a is inferred by Rust.

&mut x creates amutable reference of type &'a mut T:• Ownership temporarily borrowed• Borrow lasts for inferred lifetime 'a

• Mutation, no aliasing• Unique pointer

6

Shared Borrowing

let mut x = 1;

join (|| println!("Thread 1: {}", &x),

|| println!("Thread 2: {}", &x);)

x = 2;

&x creates a shared reference of type &'a T

• Ownership borrowed for lifetime 'a

• Can be aliased• Does not allow mutation

After 'a has ended, x is writeable again.

7

Shared Borrowing

let mut x = 1;

join (|| println!("Thread 1: {}", &x),

|| println!("Thread 2: {}", &x));

x = 2;

&x creates a shared reference of type &'a T

• Ownership borrowed for lifetime 'a

• Can be aliased• Does not allow mutation

After 'a has ended, x is writeable again.

7

Shared Borrowing

let mut x = 1;

join (|| println!("Thread 1: {}", &x),

|| println!("Thread 2: {}", &x));

x = 2;

&x creates a shared reference of type &'a T

• Ownership borrowed for lifetime 'a

• Can be aliased• Does not allow mutation

After 'a has ended, x is writeable again.

7

Rust’s type system is basedon ownership:1. Full ownership: T2. Mutable borrowedreference: &'a mut T

3. Shared borrowedreference: &'a T

Lifetimes 'a decide howlong borrows last.

Aliasing+

Mutation

8

But what if I needaliased mutable state?

Synchronization mechanisms:• Locks, channels, . . .

Memory management:• Reference counting, . . .

9

let m = Mutex::new(1); // m : Mutex<i32>

// Concurrent increment:

// Acquire lock, mutate, release (implicit)

join (|| *(&m).lock().unwrap() += 1,

|| *(&m).lock().unwrap() += 1);

// Unique owner: no need to lock

println!("{}", m.get_mut().unwrap())

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> LockResult<MutexGuard<'a, i32>>

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> &'a mut i32

10

let m = Mutex::new(1); // m : Mutex<i32>

// Concurrent increment:

// Acquire lock, mutate, release (implicit)

join (|| *(&m).lock().unwrap() += 1,

|| *(&m).lock().unwrap() += 1);

// Unique owner: no need to lock

println!("{}", m.get_mut().unwrap())

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> LockResult<MutexGuard<'a, i32>>

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> &'a mut i32

10

let m = Mutex::new(1); // m : Mutex<i32>

// Concurrent increment:

// Acquire lock, mutate, release (implicit)

join (|| *(&m).lock().unwrap() += 1,

|| *(&m).lock().unwrap() += 1);

// Unique owner: no need to lock

println!("{}", m.get_mut().unwrap())

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> LockResult<MutexGuard<'a, i32>>

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> &'a mut i32

10

let m = Mutex::new(1); // m : Mutex<i32>

// Concurrent increment:

// Acquire lock, mutate, release (implicit)

join (|| *(&m).lock().unwrap() += 1,

|| *(&m).lock().unwrap() += 1);

// Unique owner: no need to lock

println!("{}", m.get_mut().unwrap())

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> LockResult<MutexGuard<'a, i32>>

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> &'a mut i32

Interior mutability

10

let m = Mutex::new(1); // m : Mutex<i32>

// Concurrent increment:

// Acquire lock, mutate, release (implicit)

join (|| *(&m).lock().unwrap() += 1,

|| *(&m).lock().unwrap() += 1);

// Unique owner: no need to lock

println!("{}", m.get_mut().unwrap())

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> LockResult<MutexGuard<'a, i32>>

Type of lock:

fn lock<'a>(&'a Mutex<i32>)

-> &'a mut i32

Interior mutability

Aliasing+

Mutation?

10

unsafe

fn lock<'a>(&'a self) -> LockResult<MutexGuard<'a, T>>

{

unsafe {

libc::pthread_mutex_lock(self.inner.get());

MutexGuard::new(self)

}

}

Mutex has an unsafe implementation. Butthe interface (API) is safe:fn lock<'a>(&'a Mutex<i32>) -> &'a mut T

11

unsafe

fn lock<'a>(&'a self) -> LockResult<MutexGuard<'a, T>>

{

unsafe {

libc::pthread_mutex_lock(self.inner.get());

MutexGuard::new(self)

}

}

Mutex has an unsafe implementation. Butthe interface (API) is safe:fn lock<'a>(&'a Mutex<i32>) -> &'a mut T

11

unsafe

fn lock<'a>(&'a self) -> LockResult<MutexGuard<'a, T>>

{

unsafe {

libc::pthread_mutex_lock(self.inner.get());

MutexGuard::new(self)

}

}

Mutex has an unsafe implementation. Butthe interface (API) is safe:fn lock<'a>(&'a Mutex<i32>) -> &'a mut T

Similar for join: unsafely implemented userlibrary, safe interface.

11

Goal: Prove safety of Rust and itsstandard library.

Safety proof needs to be extensible.12

The λRust type system

τ ::= bool | int | ownn τ | &κmut τ | &κ

shr τ | Πτ | Στ | . . .

T ::= ∅ | T,p C τ | . . .

Typing context assigns types to paths p(denoting �elds of structures)

Core substructural typing judgments:

Γ | E; L | T1 ` I a x. T2 Γ | E; L | K, T ` F

Typing individual instructions I(E and L track lifetimes)

Typing whole functions F(K tracks continuations)

13

The λRust type system

τ ::= bool | int | ownn τ | &κmut τ | &κ

shr τ | Πτ | Στ | . . .T ::= ∅ | T,p C τ | . . .

Typing context assigns types to paths p(denoting �elds of structures)

Core substructural typing judgments:

Γ | E; L | T1 ` I a x. T2 Γ | E; L | K, T ` F

Typing individual instructions I(E and L track lifetimes)

Typing whole functions F(K tracks continuations)

13

The λRust type system

τ ::= bool | int | ownn τ | &κmut τ | &κ

shr τ | Πτ | Στ | . . .T ::= ∅ | T,p C τ | . . .

Typing context assigns types to paths p(denoting �elds of structures)

Core substructural typing judgments:

Γ | E; L | T1 ` I a x. T2 Γ | E; L | K, T ` F

Typing individual instructions I(E and L track lifetimes)

Typing whole functions F(K tracks continuations)

13

The λRust type system

τ ::= bool | int | ownn τ | &κmut τ | &κ

shr τ | Πτ | Στ | . . .T ::= ∅ | T,p C τ | . . .

Typing context assigns types to paths p(denoting �elds of structures)

Core substructural typing judgments:

Γ | E; L | T1 ` I a x. T2 Γ | E; L | K, T ` F

Typing individual instructions I(E and L track lifetimes)

Typing whole functions F(K tracks continuations)

13

The λRust type system

τ ::= bool | int | ownn τ | &κmut τ | &κ

shr τ | Πτ | Στ | . . .T ::= ∅ | T,p C τ | . . .

Typing context assigns types to paths p(denoting �elds of structures)

Core substructural typing judgments:

Γ | E; L | T1 ` I a x. T2 Γ | E; L | K, T ` F

Typing individual instructions I(E and L track lifetimes)

Typing whole functions F(K tracks continuations)

13

Syntactic type safety

E; L | K, T ` F =⇒ F is safe

Usually proven by progress and preservation.

But what about unsafe code?

Use a semantic approach based on logical relations.

14

Syntactic type safety

E; L | K, T ` F =⇒ F is safe

Usually proven by progress and preservation.

But what about unsafe code?

Use a semantic approach based on logical relations.

14

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

15

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

15

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

We use Iris to de�ne ownership:• Concurrent separation logic• Designed to derive new reasoningprinciples inside the logic

15

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

Lift to semantic contexts JTK(t):

Jp1 C τ1,p2 C τ2K(t) :=

Jτ1K.own(t, [p1]) ∗ Jτ2K.own(t, [p2])

Separating conjunction

15

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

Lift to semantic contexts JTK(t):

Jp1 C τ1,p2 C τ2K(t) :=

Jτ1K.own(t, [p1]) ∗ Jτ2K.own(t, [p2])

Separating conjunction

15

The logical relation

Ownership predicate for every type τ :

JτK.own(t, v)

Owning thread’s ID Data in memory

Lift to semantic typing judgments:

E; L | T1 |= I |=T2 :=

∀t. {JEK ∗ JLK ∗ JT1K(t)} I {JEK ∗ JLK ∗ JT2K(t)}

15

Compatibility lemmas

Connect logical relation to type system:Semantic versions of all syntactic typing rules.

Γ | E; L ` κ aliveΓ | E; L | p1 C &κ

mut τ,p2 C τ ` p1 := p2 a p1 C &κmut τ

E; L | T1 ` I a x. T2 E; L | K; T2, T ` FE; L | K; T1, T ` let x = I in F

Well-typed programs can’t go wrong• No data race• No invalid memory access

16

Compatibility lemmas

Connect logical relation to type system:Semantic versions of all syntactic typing rules.

Γ | E; L |= κ aliveΓ | E; L | p1 C &κ

mut τ,p2 C τ |= p1 := p2 |=p1 C &κmut τ

E; L | T1 |= I |=x. T2 E; L | K; T2, T |= FE; L | K; T1, T |= let x = I in F

Well-typed programs can’t go wrong• No data race• No invalid memory access

16

Compatibility lemmas

Connect logical relation to type system:Semantic versions of all syntactic typing rules.

Γ | E; L |= κ aliveΓ | E; L | p1 C &κ

mut τ,p2 C τ |= p1 := p2 |=p1 C &κmut τ

E; L | T1 |= I |=x. T2 E; L | K; T2, T |= FE; L | K; T1, T |= let x = I in F

Well-typed programs can’t go wrong• No data race• No invalid memory access

16

Linking with unsafe code

` ` ```

`unsafe

00

0

The whole program is safe ifthe unsafe pieces are safe!

17

Linking with unsafe code

` ` ```

`unsafe�

��

The whole program is safe ifthe unsafe pieces are safe!

17

Linking with unsafe code

` ` ```

`unsafe�

��

The whole program is safe ifthe unsafe pieces are safe!

17

How do we de�neJτK.own(t,v)?

18

Jownn τK.own(t, v) :=

∃`. v = [`] ∗ .(∃w. ` 7→ w ∗ JτK.own(t,w)

)∗ . . .

J&κmut τK.own(t, v) :=

∃`. v = [`] ∗ &κfull

(∃w. ` 7→ w ∗ JτK.own(t,w)

)

Lifetime logic connective

19

Jownn τK.own(t, v) :=

∃`. v = [`] ∗ .(∃w. ` 7→ w ∗ JτK.own(t,w)

)∗ . . .

J&κmut τK.own(t, v) :=

∃`. v = [`] ∗ &κfull

(∃w. ` 7→ w ∗ JτK.own(t,w)

)

Lifetime logic connective

19

Jownn τK.own(t, v) :=

∃`. v = [`] ∗ .(∃w. ` 7→ w ∗ JτK.own(t,w)

)∗ . . .

J&κmut τK.own(t, v) :=

∃`. v = [`] ∗ &κfull

(∃w. ` 7→ w ∗ JτK.own(t,w)

)

Lifetime logic connective

19

Jownn τK.own(t, v) :=

∃`. v = [`] ∗ .(∃w. ` 7→ w ∗ JτK.own(t,w)

)∗ . . .

J&κmut τK.own(t, v) :=

∃`. v = [`] ∗ &κfull

(∃w. ` 7→ w ∗ JτK.own(t,w)

)Lifetime logic connective

19

Traditionally, P ∗ Q splitsownership in space.

Lifetime logic allowssplitting ownership in time!

20

P V &κfull P ∗

([†κ]V P

)now [†κ]

time

κ alive κ dead

Access to P while κ lastsAccess to P when κ has endedThe lifetime logic has been

fully derived inside Iris.

21

P V &κfull P ∗

([†κ]V P

)

now [†κ]

time

Access to P while κ lasts

Access to P when κ has endedThe lifetime logic has beenfully derived inside Iris.

21

P V &κfull P ∗

([†κ]V P

)

now [†κ]

time

Access to P while κ lastsAccess to P when κ has ended

The lifetime logic has beenfully derived inside Iris.

21

P V &κfull P ∗

([†κ]V P

)

now [†κ]

time

Access to P while κ lastsAccess to P when κ has endedThe lifetime logic has been

fully derived inside Iris.

21

What else is in the paper?• More details about λRust, the type system, andthe lifetime logic

• How to handle interior mutability that is safe forsubtle reasons (e.g., mutual exclusion)

• Mutex<T>, Cell<T>

, RefCell<T>, Rc<T>, Arc<T>,RwLock<T> (found a bug), . . .

Still missing from RustBelt:• Trait objects (existential types), weak memory,drop, . . .

22

What else is in the paper?• More details about λRust, the type system, andthe lifetime logic

• How to handle interior mutability that is safe forsubtle reasons (e.g., mutual exclusion)

• Mutex<T>, Cell<T>, RefCell<T>, Rc<T>, Arc<T>,RwLock<T> (found a bug), . . .

Still missing from RustBelt:• Trait objects (existential types), weak memory,drop, . . .

22

What else is in the paper?• More details about λRust, the type system, andthe lifetime logic

• How to handle interior mutability that is safe forsubtle reasons (e.g., mutual exclusion)

• Mutex<T>, Cell<T>, RefCell<T>, Rc<T>, Arc<T>,RwLock<T> (found a bug), . . .

Still missing from RustBelt:• Trait objects (existential types), weak memory,drop, . . .

22

Logical relations can be used to prove safetyof languages with unsafe operations.

Advances in separation logic (as embodied inIris) make this possible for even a language

as sophisticated as Rust!

https://plv.mpi-sws.org/rustbelt

23